Wave A2 — finish the host_effect_apply spine: typed effects + Do{effect} target band (the keystone that unblocks the bulk). Per docs/plans/host-effect-orchestration.md (the std.effect_plan band; 'leaves = Do{effect} — never a command string') + docs/plans/shell-intent-emit-realization-design.md ('ca

[gunbai-bot]

Auto-opened by session-dashboard for session vivid-dove-796.
Pushing to session/vivid-dove-796 advances this PR.

Worker attestation

• Title describes the change (not the session id or branch).
• PR body summarises what and why.
• Tests run: gunbc compile (clean) + host_effect_plan_witness_holds (green).
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

Mint the generic std.effect_plan band (EffectPlan<E> with Do { effect: E } leaves — never command strings) and the product-layer host_effect_plan_apply interpreter that routes EffectPlan<HostEffect> through the existing host_effect_apply spine. Control-flow steps (If, For, While, etc.) refuse fail-closed until predicate interpretation lands. This is Wave A2 per docs/plans/host-effect-orchestration.md §1b and unblocks the shell→intent migration bulk.

Test plan

• gunbc compile --source-root src/v2 --source-root dag --target dag — clean on 63ab31c
• host_effect_plan_witness_holds — true (Do converges, failure fails closed, sequential Do converges, If refuses)
• CI floor (claim_executor on PR) — queued; prior failures were self-hosted runner acquisition, not code

[gunbai-bot]

Review 40023 — placeholder ShellCommand{script: \"\"} on refusal paths

Verified: the finding is correct. host_effect_plan_placeholder_effect() at dag/gunbc/host_effect_plan.dag:38-40 mints an empty shell command solely to satisfy NotConverged { applied: HostEffectIntent } on pre-apply refusal arms (unsupported control-flow, empty plan). It never executes — those arms return before host_effect_apply — but it is still a fabricated plausible effect on a failure arm, which §5 rightly flags.

Why not fixed in this keystone: std.realization_reconcile.Reconciliation requires applied: A for both variants (dag/std/realization_reconcile.dag:14-16); there is no Optional / RefusedBeforeApply shape today. Elsewhere on the spine, NotConverged.applied carries the real intent that was attempted (e.g. host_effect_realize.dag transport-mismatch refusals). These two paths have no effect to ground yet — the right fix is widening the reconcile carrier (applied: Optional<A> or a named pre-apply refusal variant), not another local placeholder. Tracked as follow-up on the reconcile-carrier lane; out of scope for Wave A2's Do-leaves-only keystone.

— sent from vivid-dove-796

[gunbai-bot]

Review 40128 — two non-blocking follow-ups

Both findings verified against current b9604d495b:

1. Placeholder ShellCommand{script:\"\"} on NotConverged.applied (host_effect_plan.dag:38-54, :114-124) — valid §5 nit. Already replied on review 40023: Reconciliation.applied is total today, so pre-apply refusal arms need a reconcile-carrier widening (Optional / pre-apply refusal variant), not another local placeholder. Held per calm-ferret-849 operator-review gate — will not expand the model until relayed.

2. plan.on_failure not interpreted — valid latent narrowing. Wave A2 scope is Do-leaves-only; host_effect_plan_apply_rest stops on first !reconciliation_converged (fail-fast), which matches every witness's FailFast and is stricter than a silent widen. Non-FailFast policies will get a typed PolicyUnsupported refusal (or interpretation via the control-flow/predicate lane) when that lane lands — dissolve-on pairs with host_effect_plan_unsupported_step_reason / predicate interpretation, not this keystone.

No code change in this PR; both tracked as follow-up on the reconcile-carrier + control-flow lanes.

— sent from vivid-dove-796